VO and Group admin have the right to force synchronization of group.
New authz for topGroupCreator

TopGroupCreator can call getCompleteRichMembers and getGroups

GroupManager can call this methods anyway and topGroupCreator can easily
create group and become groupManager

This is hack for eduGAIN group service - because miniapplication for
eduGAIN group service call this methods at start and not when they are
really needed.
Do not set role VO_OBSERVER in eduGain registrar module

Users in eduGain group service should not see other user's groups
Hack to add perunv3/admin@META as privileged user
All VO edugain_group members get groupManager of members group

Without that they can't see other members' preferred mails.
AuthzResolverBl.getPerunPrincipal calls refresh authz

It's important for external application / libraries to have up-to-date
authz for actor.